Bug 13582 - libtorrent-rasterbar new security issue due to UPNP port 0
Summary: libtorrent-rasterbar new security issue due to UPNP port 0
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/603224/
Whiteboard: MGA3TOO advisory has_procedure mga3-3...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-06-23 19:36 CEST by David Walser
Modified: 2014-09-05 11:08 CEST (History)
4 users (show)

See Also:
Source RPM: libtorrent-rasterbar-0.16.16-1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-06-23 19:36:22 CEST
Fedora has issued an advisory on June 16:
https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134652.html

I'm not sure exactly what the issue is, but they announced it as a security update and added a patch in this commit (which also references an upstream bug report):
http://pkgs.fedoraproject.org/cgit/rb_libtorrent.git/commit/?h=f20&id=70d2aadf0aec2c26b6e79cfe881b4be14fce2231

Reproducible: 

Steps to Reproduce:
David Walser 2014-06-23 19:36:32 CEST

Whiteboard: (none) => MGA4TOO, MGA3TOO

Comment 1 Matteo Pasotti 2014-06-24 00:01:40 CEST
wip

Status: NEW => ASSIGNED

Comment 2 David Walser 2014-06-24 16:42:49 CEST
Possible CVE request:
http://openwall.com/lists/oss-security/2014/06/24/13

Also, Matteo fixed this in Cauldron by update to 0.16.17.

Looking at the upstream discussion of this issue, it's not clear if all 0.16.x versions are affected, so you might want to test it to verify whether or not Mageia 3 and Mageia 4 are actually affected.

Version: Cauldron => 4
Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO

Comment 3 leigh scott 2014-06-25 08:30:18 CEST
(In reply to David Walser from comment #2)

> Looking at the upstream discussion of this issue, it's not clear if all
> 0.16.x versions are affected, so you might want to test it to verify whether
> or not Mageia 3 and Mageia 4 are actually affected.

I believe all 0.16.x versions built against boost-1.5x.x are affected.
F19 which uses boost-1.53.x was affected so I believe Mageia 3 will be as well.

CC: (none) => leigh123linux

Comment 4 Angelo Naselli 2014-07-02 22:21:56 CEST
libtorrent-rasterbar 0.16.17 and qttorrent have been built for mga4 and are in
update testing.

CC: (none) => anaselli

Comment 5 David Walser 2014-07-02 23:12:34 CEST
We'll need an update built for Mageia 3 as well.

I don't believe the qbittorrent rebuild was necessary.  Looking at the package metadata, it's dynamically linked to libtorrent-rasterbar's library, and the library's major number hasn't changed.

Packages built so far:
libtorrent-rasterbar7-0.16.17-1.mga4
python-libtorrent-rasterbar-0.16.17-1.mga4
libtorrent-rasterbar-devel-0.16.17-1.mga4

from libtorrent-rasterbar-0.16.17-1.mga4.src.rpm
Comment 6 Angelo Naselli 2014-07-02 23:23:19 CEST
well maybe not but spec file says:
BuildRequires:  pkgconfig(libtorrent-rasterbar) >= 0.14.4
Comment 7 David Walser 2014-07-02 23:28:54 CEST
(In reply to Angelo Naselli from comment #6)
> well maybe not but spec file says:
> BuildRequires:  pkgconfig(libtorrent-rasterbar) >= 0.14.4

Which by itself could mean it's statically or dynamically linked (dynamically is by far the more typical case).  "urpmq --requires qbittorrent" shows the library listed, which indicates that it's dynamically linked.
Comment 8 Angelo Naselli 2014-07-03 09:08:05 CEST
on comment #7, David you are right as i wrote last night via irc i answered without thinking... sorry. Feel free to remove it from testing.
Comment 9 Matteo Pasotti 2014-08-31 23:14:33 CEST
I have uploaded a patched package for Mageia 3 also.

You can test it by verifying that opening upnp port 0 do not open all your ports, as described here[1].

References:
[1] https://github.com/qbittorrent/qBittorrent/issues/1758

Status: ASSIGNED => NEW
Assignee: matteo.pasotti => qa-bugs

Comment 10 David Walser 2014-08-31 23:20:47 CEST
Thanks Matteo!

Advisory:
========================

Updated libtorrent-rasterbar packages fix security vulnerability:

The libtorrent-rasterbar library was opening UPNP port 0, causing all ports
to be forwarded from the router to the client machine.

References:
https://github.com/qbittorrent/qBittorrent/issues/1758
https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134652.html
========================
Updated packages in core/updates_testing:
========================
libtorrent-rasterbar7-0.16.6-2.1.mga3
python-libtorrent-rasterbar-0.16.6-2.1.mga3
libtorrent-rasterbar-devel-0.16.6-2.1.mga3
libtorrent-rasterbar7-0.16.17-1.mga4
python-libtorrent-rasterbar-0.16.17-1.mga4
libtorrent-rasterbar-devel-0.16.17-1.mga4

from SRPMS:
libtorrent-rasterbar-0.16.6-2.1.mga3.src.rpm
libtorrent-rasterbar-0.16.17-1.mga4.src.rpm
David Walser 2014-08-31 23:21:12 CEST

CC: (none) => matteo.pasotti

Comment 11 claire robinson 2014-09-01 18:40:18 CEST
Testing complete mga4 64

Started qbittorrent and checked using 'Shields Up!' at http://www.grc.com. My router doesn't log upnp port forwarding. Ran an 'All service ports' test and it showed blues  for the closed ports of the computer running qbittorrent and red open ports rather than greens as it should be. Effectively putting the qbittorrent computer in DMZ.

Run again with the update installed and a router reboot it then shows everything green as it should, not being forwarded.

Whiteboard: MGA3TOO => MGA3TOO has_procedure mga4-64-ok

Comment 12 claire robinson 2014-09-02 17:58:41 CEST
Testing complete mga4 32

It can also be seen in the qbittorrent 'Execution Logs' from the View menu.

Before
------
Shows two port 6881 but also..
02/09/2014 16:44:36 - UPnP/NAT-PMP: Port mapping successful, message: successfully mapped port using UPnP. external port: 0


After
-----
Just two...
02/09/2014 16:47:58 - UPnP/NAT-PMP: Port mapping successful, message: successfully mapped port using UPnP. external port: 6881


Confirmed at grc.com that just port 6881 was being forwarded.

Whiteboard: MGA3TOO has_procedure mga4-64-ok => MGA3TOO has_procedure mga4-32-ok mga4-64-ok

Comment 13 claire robinson 2014-09-02 18:11:47 CEST
Testing complete mga3 32

Whiteboard: MGA3TOO has_procedure mga4-32-ok mga4-64-ok => MGA3TOO has_procedure mga3-32-ok mga4-32-ok mga4-64-ok

Comment 14 claire robinson 2014-09-02 18:17:12 CEST
Testing complete mga3 64

Whiteboard: MGA3TOO has_procedure mga3-32-ok mga4-32-ok mga4-64-ok => MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok

Comment 15 claire robinson 2014-09-02 18:26:24 CEST
Validating. Advisory uploaded. Thanks for your input Leigh.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok => MGA3TOO advisory has_procedure mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok
CC: (none) => sysadmin-bugs

Comment 16 Mageia Robot 2014-09-05 11:08:22 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0364.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.